KEV watch Weekly
Vulnerabilities CISA confirmed as exploited in the last two weeks. Updated 2026-07-25.
What CISA added to the Known Exploited Vulnerabilities catalog in the last two weeks. Everything on this list is being used in the wild right now, which is the single strongest reason to patch something ahead of a four figure backlog. 16 added, 0 flagged for ransomware use.
| Added | CVE | Vendor | Product | Ransomware |
|---|---|---|---|---|
| 2026-07-22 | CVE-2026-16232 | Check Point | SmartConsole | |
| 2026-07-22 | CVE-2026-50522 | Microsoft | SharePoint | |
| 2026-07-21 | CVE-2026-60137 | WordPress | Core | |
| 2026-07-21 | CVE-2026-63030 | WordPress | Core | |
| 2026-07-21 | CVE-2026-0770 | Langflow | Langflow | |
| 2026-07-21 | CVE-2021-27137 | DD-WRT | DD-WRT | |
| 2026-07-16 | CVE-2026-58644 | Microsoft | SharePoint | |
| 2026-07-16 | CVE-2026-25089 | Fortinet | FortiSandbox | |
| 2026-07-16 | CVE-2026-39808 | Fortinet | FortiSandbox | |
| 2026-07-15 | CVE-2026-46817 | Oracle | E-Business Suite | |
| 2026-07-15 | CVE-2023-4346 | KNX Association | KNX Protocol Connection Authorization Op | |
| 2026-07-14 | CVE-2026-56155 | Microsoft | Active Directory Federation Services | |
| 2026-07-14 | CVE-2026-56164 | Microsoft | SharePoint Server | |
| 2026-07-14 | CVE-2026-15409 | SonicWall | SMA1000 Appliances | |
| 2026-07-14 | CVE-2026-15410 | SonicWall | SMA1000 Appliances | |
| 2026-07-13 | CVE-2008-4128 | Cisco | IOS |
Source: CISA Known Exploited Vulnerabilities catalog, refreshed daily. "Ransomware" marks entries CISA associates with a known ransomware campaign. Click a CVE for our full writeup.
If any product on this list is in your environment, it
jumps the queue. Known-exploited beats every severity score, because the
hard part, a working exploit, is already done.